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We present a family of loss-tolerant quantum strong coin flipping protocols; each 
protocol differing in the number of qubits employed. For a single qubit we obtain a 
bias of 0.4, reproducing the result of Berlin et al. [Phys. Rev. A 80, 062321 (2009)], while 
for two qubits we obtain a bias of 0.3975. Numerical evidence based on semi-definite 
programming indicates that the bias continues to decrease as the number of qubits is 
increased but at a rapidly decreasing rate. 



^ . I. INTRODUCTION 

o : 

' Coin flipping (CF) is a cryptographic task in which a pair of remote distrustful parties, usually referred to as Alice 
' and Bob, must agree on a random bit. The problem was first introduced in 1981 by Blum [1], who studied it in 
^ ' classical settings. There are two variants of the problem: 'strong' CF (SCF) and 'weak' CF (WCF). In SCF each 
\ party is not aware of the other's preference for the coin's outcome. In contrast, in WCF the parties have opposite 
^^C> . and known preferences. Hence, in WCF there is always a winner and a loser, unless one of the parties is caught 
' cheating, in which case the protocol is aborted. Let P^y denote the probability that the Alice (Bob) obtains the 
(— I , outcome x (y) and let P± denote the probability that the protocols is aborted. If both parties are honest then 
O I Poo = Pii = 1/2 and Pio = Poi = P± = 0, i.e. the parties always agree on the outcome of the coin. The security of a 
I ' , CF protocol is quantified by the extent to which dishonest parties can bias the outcome. We denote by P,i=l/2 + e»i 
^ ' (Pi*=l/2 + ei») the maximal probability of Alice (Bob) to bias the outcome to i. In SCF the bias is defined as 
^ [ e=max{e*07 £*i7 eo*i ^i*}: while in WCF the maximum is taken over only two of the biases: If, for example, Alice 
prefers the outcome 0, then the bias equals max{e,o, ei*}- A protocol is said to be fair whenever both parties enjoy 
the same bias. 

In classical settings, given unlimited computational power, a dishonest party can always bias the outcome as it 
desires In contrast, this is not the case in quantum settings. Aharonov et al. formulated the first (non-trivial) 
[ quantum SCF protocol in 2000 [3]. This protocol, which achieves a bias of 0.354 began the quest for a SCF 
protocol with a vanishing bias. First, Spekkens and Rudolph devised a protocol with a bias of 0.309 Ambainis 
[5| and independently Spekkens and Rudolph ||6|] soon afterwards introduced protocols pushing the bias to as low as 
1/4. However, the prospects of further progress were soon shadowed by two key results. Ambainis proved that any 
protocol with a bias of e, whether strong or weak, must consist of at least f2(log log e~^) rounds of communication 
(<~^ [^], while Kitaev proved that the bias of any quantum SCF protocol is bounded by (\/2— l) /2 ~ 0.207 [7|. Until 
' recently, it was not known whether this bound can be saturated or whether the bias of 1 /4 is optimal. This point has 
T— I now been settled by Chailloux and Kerenidis who have presented a protocol that saturates Kitaev's bound [8l| , based 
^ on Mochon's work proving the possibility of quantum WCF with arbitrarily small bias [9,]. 

, Quantum WCF was first analyzed by Spekkens and Rudolph in 2001, who introduced a family of protocols that 
' achieves a bias of (v^ — l) /2 [13 ■ (Previously Goldenberg et al. analyzed the problem of quantum gambling 
H I [m, which is a closely related cryptographic task.) This result was subsequently improved upon by Mochon who 
considered WCF protocols with an infinite number of rounds [l^ [T^ , eventually culminating in the aforementioned 
res ult Ml - In addition, quantum SCF and WCF have also been studied in the multi-party [14] multi-outcome scenario 
[H [III and most recently in both [iTlfTst. 
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Even though from a purely theoretical viewpoint a lot of progress has been made in our understanding of quantum 
CF, most quantum CF protocols are impractical due to the non-ideal conditions prevalent in any real- life implemen- 
tation. These include uncertainties in the preparation and measurement of states, whether inherent or due to noise, 
as well as noise and losses in the quantum channels and the quantum memory storage. In the sending of quantum 
information over long distances the most common source of malfunctions is losses. The problem with losses is that 
they introduce a finite probability for an indefinite outcome - actually no outcome at all - even when both parties are 
honest, so that there is always a non- vanishing chance for the protocol to be aborted (i.e. P± = 1 — Pqo — Pn > 0). 
As pointed out in (l5| . one way to avoid this situation, is to restart the protocol each time an indefinite outcome 
occurs, but this in turn affords a dishonest party very simple cheating strategies, which may even go so far as to 
enable it to bias the outcome to its choosing. Remarkably, Berlin et al. have recently devised a 'loss-tolerant' SCF 
protocol [T9I, [20!| (see also [21]). That is, a protocol whose bias remains unchanged even if we allow for the protocol 
to be restarted. However, the loss-tolerance came at a price: the protocol achieves a comparatively high bias of 0.4. 
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Figure 1: Alice's preparation. Each qubit that Alice prepares is polarized along one of the four axes ±h and ±m. 

It may well be that there is always a price to be paid. Specifically, it could be that loss-tolerant SCF cannot saturate 
Kitaev's bound. Indeed, at the end of their paper Berlin et al. raise the question of whether it is possible to devise a 
loss-tolerant protocol with a lower bias than theirs. 

In this paper we answer this question in the affirmative by introducing a family of loss-tolerant SCF protocols, 
which outperforms Berlin et aVs protocol. Each member in the family differs in the number of qubits employed. 
In the one qubit case we achieve the same bias as Berlin et al., e = 0.4, while for two qubits the bias reduces to 
0.3975. Numerical evidence based on semi-definite programming suggests that the bias continues to decrease 
as the number of qubits is increased, but at a rapidly decreas ing rate. Our protocol bears some similarity to the 
original BB84 CF protocol [2^ and its various derivatives 0, , but significantly differs in that it is not based on 
bit-commitment . 



II. A FAMILY OF LOSS-TOLERANT PROTOCOLS 

The protocols read as follows: 

1. Alice selects N orientations di to cijv, where each of the d.^ is (uniformly) randomly picked from a set of four 
predetermined orientations h, —h, rh, and -rh (which are known to Bob). Alice prepares N qubits polarized 
along these orientations, i.e. the first qubit is polarized along di, the second along d2, etc., and sends these N 
qubits to Bob. 

2. Bob selects N orientations /3i to /3jv, where each of the (5i is (uniformly) randomly picked from the set of two 
orientations h and rh, and then measures the polarization of the first qubit along /3i, the polarization of the 
second along (32, etc. 

3. If all the measurements are successful (i.e. he has detected the N qubits and has obtained N definite outcomes), 
he asks Alice to proceed with the protocol, otherwise, he asks her to restart the protocol (i.e. repeat step 1). 

4. Alice sends Bob a randomly selected classical bit c. 

5. Let ri to r^r denote the outcomes of Bob's N measurements. The outcome of the coin flip o is given by 
o = c ffi {^iLi fi)- Bob informs Alice of his choice of orientations, /J^, and the corresponding outcomes, r^. 

6. Alice aborts whenever there is at least one qubit that Bob claims to have successfully measured for which 
(l-2r)/3 = -d. 

The loss tolerance of the protocol comes into play at step 3, where Bob asks Alice to restart the protocol whenever 
one or more of his measurements are unsuccessful, in which case the outcomes of the successful measurements are 
discarded. That is. Bob must successfully measure A^-qubits in a single run of the protocol. Also note that we do not 
flx the angle between the axes n and rh. Indeed, this angle is a free a parameter. In particular, it turns out that by 
manipulating it we can make the protocol 'fair' in the sense that Alice's and Bob's maximal biases are equal. 
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III. ALICE'S MAXIMAL BIAS 

It will prove convenient to choose the coordinate system such that n and m lie on the x z plane, spanning an angle 
of 6, —6, respectively, from the z axis (see Fig. 1). 

Since Bob is honest he will measure each qubit along one of the two axes h and m with equal probability. Suppose 
that Alice wishes to bias the outcome to 0. With no loss of generality we assume that Alice selects c = 0. Then the 
probability that she is successful equals 

1 ^ 
pW=m.ix^ E ••• E P{^n = 0\{h,b2,...,bj,},p); (1) 

6i=n,m 1/^1=71,171 

the superscript A'' serving to denote the number of qubits employed in the protocol. Introducing the operator 

1 ^ 

n^=^ E E ••• E E ©(«i-«2-...-Siv)(g)|t,,s.>(t«,sJ- (2) 

where 8 {x) is the Heaviside step function, we have that 

Pio^)=maxTr(pn;v) . (3) 

Clearly, the maximum obtains when p equals the (normalized) eigenvector (or any one of the eigenvectors) of IIjv 
corresponding to the greatest eigenvalue. Making use of the fact that 

Itiri) (tin I + |t±m) (t±m | = 1 ± COS {9) (4) 

(and si • S2 • • • • • Siv = 1 since Alice wishes to bias the outcome to 0), eq. (2) simplifies to 

1 ^ 
^ E ••• E 0(si-S2-...-s^)(g)(li + SiCos(^)aW) 

N N N 

^ E ••• E e(si.s2-...-siv)(i+E«'Co«w^i'^+2E E ^.^.cos^w^^'si^'^ 

N 

r.N , 



n 



+ . . . + COS 

i=l 
N 



i=l 

= i(l + cos^(^)(g)aW). (5) 
1=1 

Here we use the notation 

Sa^=li ® ...«) li-i ® O ...0 Ijv, a = x,y,z (6) 

with ti denoting the identity operator on the Hilbert space of the ith qubit. The eigenvalues of IIjv equal 
(l ± cos^ {9)) /2. The resulting biases are thus given by 

nr=n'f^-^(l + cos^W), (7) 
since the probability of biasing to and 1 are patently equal. 



IV. BOB'S MAXIMAL BIAS 



In the following it will prove economical to employ the following notation: |V-'o"'') = |tfi), |''/'o^'') = |in): |'0i"'')^|tm), 
|^i^^)=|-l-m), so that the basis Iffi), \in) iltm), \im}) is denoted by (1). In addition, we define |V'b'^)= I V't^"'')' 
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where b= 62, ■ • ■ , ^w) and r= (ri, r2, . . . , r^) are binary iV-tuples, i.e. 5i, € {0, 1}. 

The loss-tolerant nature of the protocol allows (a dishonest) Bob to carry out a measurement at step 2 to decide 
whether to keep the N the qubits. Only when he has decided to keep them does he proceed to step 4. Then, 
depending on the value of the classical bit c (received at step 4), he will carry out another measurement on the N 
qubits at step 5. The outcome of this measurement instructs him what iV-tuples b and r to tell Alice that he selected 
and (supposedly) obtained, respectively. More specifically, at step 2 Bob will carry out a two-outcome POVM with 
elements Hp, IIis = 1 — Hp. If he obtains the outcome associated with Ilrs he asks Alice to restart the protocol. 
Otherwise, if he obtains the outcome associated with Hp, he keeps the qubits and they proceed to step 4. At step 5 
Bob already knows the value of c. Let us assume that he would like to bias the outcome to 0, then to optimize his 
chances of being successful he will have to tell Alice announce an A^-tuple r such that Vi — 0® c — c. He will then 
carry out an additional POVM on the A^-qubits with 2'^^~^ outcomes, which instructs him what A^-tuples b and r to 
announce. We will denote this second POVM by Hq^, where the subscripts and c correspond to the value to which 
Bob wants to bias the coin and the value of the classical bit sent by Alice, and the superscripts b and r correspond 
to the choice of bases and the associated outcomes that he sends Alice. Hence, a cheating strategy designed to obtain 
the outcome consists of a set of three POVMs with elements {Hp, His}, {^qq I ® = 0} and {Hq^* \ — 1}. 

In the following it will facilitate matters to introduce the positive operators Mp^^-y/HpHg^ y^Hp, which we note 
satisfy 

^ ^ M^^^^^Y. E ns^yn; = Hp. (8) 



{b} {r|©, r.=c} {b}{r|©;n=c} 

Suppose now that Alice prepared at step 1 the state |'0a*''), and, having been asked to proceed with the protocol, 
sends Bob the classical bit c at step 4. Bob gets caught cheating when for one or more of the qubits, bi = ai and 
fi = Si ® 1. Bob's minimal probability of being caught cheating therefore equals 

t^"oc J- c=0,l {a} {s} {b} {rt®^ ri=c} J = l \V^a l-L-lplV'a / 

where the summation is carried out over the set of all possible binary A^-tuples, {a}, {b}, {s}, and {r | ® j — c}. 
The Heaviside step-function, additionally defined such that 8 (0) =0, serves to guarantee that only terms, which 
satisfy bi = a.i and = © 1 for at least one i S {1, 2, . . . , n}, contribute. Finally, the 2^^+^ factor is just the 
number of possible choices for the triplet c, a, and s. 

Clearly, no value of c is in any way preferable for Bob, nor is any orientation or any particular qubit. This implies 
the existence of an optimal symmetric cheating strategy in the sense that all of the POVM elements (pertaining 
to both the POVM carried out when c — and the POVM carried out when c — 1) contribute equally. To see 
this, we first assume the existence of an optimal (possibly asymmetric) strategy. Let {Mqq} and {Mg}"} denote the 
corresponding two sets of positive operators. Then, for any binary A^-tuple u, another optimal cheating strategy is 
obtained by the transformation 

Kc ^ Ml = S^Mg^^S!^ , (10) 

where S"=H|L]^ (q = y, z) and a© b= (ai © 61, . . . , ajs © ^at), corresponding to rotations by tt about the 

z axes of the coordinate systems of the set of qubits {i \ Ui = 1} . Similarly, for any binary A^-tuple u, we obtain yet 
another optimal cheating strategy via 

M^^ ^ 7i^reub©u _ yiu TiVrbyu /i i \ 

Mp^ JW0c©(®,«0 - ^x^^hc ^x ; U-LJ 

corresponding to rotations by tt about the x axes of the coordinate systems of the set of qubits {i \ Ui = \} . (When 
0j Ui = 1 we switch from a POVM corresponding to one value of c to a POVM corresponding to the other value.) 

Now a strategy in which Bob chooses at random between different optimal strategies is also optimal. By choosing 
uniformly at random between optimal strategies related by the transformations eqs. (|10p and ([TT|) . Bob obtains an 
optimal strategy characterized by the positive operators 

n^rb ^ \ ^ \ ^ 'puvTW wr©u bffiw©uvuvw . I -i r,\ 

{u} {w} 

the only subtle point in the above argument concerns those transformations given by eq. ([TT|) that modify the value 
c and exchange between elements in {Mg^} and {A/qJ'}. Nevertheless, this does not pose a problem since in an 



5 



optimal cheating strategy the overall contribution to the cheating probability when c = and c = 1 must be equal, 
and, moreover, eqs. (jlip and the invariance of Hp under the application of the rotation operators, imply that in an 
optimal cheating strategy the sets {Mqq} and {A/q}"} can be obtained from one another via the transformation eq. 
PT|l . Finally, we note that this pair of sets, eq. (|12p . can be characterized by any of the positive operators within the 
sets, say Mgg° (0= (0, . . . , 0)). All other positive operators (including those corresponding to c = 1) can be obtained 
from it by the transformations eqs. ^TU\i and pT|) . In appendix A we prove that eqs. ([5]), pTI)l . pT|) and imply 
that one can take Hp — 1. This means that Bob stands nothing to gain by performing a measurement on the qubits 
prior to receiving the value of the classical bit c. 

The problem of optimizing Bob's bias can be cast as an SDP (see f2^ for an introduction). Using the fact that we 
can set Hp = 1 (and recalling that the rotation operators switch between all of Alices' preparations), the right-hand 
side of eq. ^ can be reexpressed as Tr (A/q ^Aat (6*)), with 

1 ^ 

aa^(^)=^eeee e 0(E'^^.-.-^^.-.ei)kir)(V'iri- as) 

c=0,l{a} {s} {b} {r|©,r,=c} J = l 

The SDP then reads 

P„(f ) = maxMO o (1 - Tr {M^^A^ (9))) (14) 
subject to 2^-iTr (Afo7) = 1, Tr(A^OoO (g)^, a«) = 0, M°° > . 

The derivation of the first two constraints is given in Appendix A. 

Now problems of this type, have associated with them a dual problem. The solution of this dual problem bounds 
from above the solution of the of the original problem, [23], which we shall refer to as the 'primal' problem. It is given 
by 

minA, (1 - iAi) (15) 
subject to Aat (6*) - All + A2 (g),^i ai'^ > , 

where the variables of the dual problem, the A^, are real scalars. 

A. The single qubit case 
It is straightforward to solve both eqs. (fTH) and in the single qubit case. The solution is given by 

P^'J =Pi'J = \{S + sinie)) , (16) 

where the second equality follows from the equality of the probabilities of biasing to and 1, and is obtained for 
2Mqq = 1 + a-x- Hence, Bob's strategy consists of measuring the polarization of the qubit along the x axis. 

B. The two-qubit case 

In the two qubit case Bob measures an eig ht outcome POVM A^'''';'®'^^ (recall that we have assumed that Bob 
wants to bias the outcome to 0). By introducing a new set of Lagrange multipliers C = Ai — A2 and x = Ai + A2, the 
dual problem can be reexpressed as 

min^.x(l-i(e + x)) (17) 

subject to A2 (0) - e (in) (tti + iu> m - x (in) (ni + in) (ni) > o . 

The solution obtains when 



det (A2 [9) - e (in) (ni + in) (ni) - x (in) (ni + in) (ni)) = o , 



(18) 



Figure 2: The dashed curve depicts Bob's maximal probability of biasing the outcome in the single qubit case, while each of 
the four other curves depict eq. (|17|) as a function of a different root of eq. (|20p . Note that two of the roots become complex 
beyond 9 ~ 0.8056. 



i.e. when the lowest eigenvalue of the constraint matrix eq. (I17p equals zero. Solving for x iii terms of ^ we get 

(cos(2g) + 7)e'-3(cos(2g) + 3)e , . 

^ 8e2 + (cos(20)-13)e-3(cos(20)-l) ■ ^ ' 

(There is another solution % = 1, but it can be shown that in this case the constraint matrix always admits a negative 
eigenvalue.) Plugging back into eq. p7p . taking the derivative with respect to i^, and equating to zero, we get a fourth 
order equation in ^ 

64^^+16 (cos (261) - 13) ,^3 + (cos (461) - 56 cos (261) + 199) ^2_6 (cos (461) - 8 cos (26i) + 7) ^+9 (cos (46*) - 1) = 0. (20) 

When plugged back into eq. (|17p three of the four roots do not give rise to expressions smaller to Bob's maximal bias 
in the single qubit case. See Fig. 2. Hence, none of these three represents a solution of the primal problem since its 
solution must bound from above the solution of the dual problem and clearly Bob can always achieve a bias equal to 
that of the single qubit case by simply not following the directions of the protocol in the handling of only one of the 
qubits. It is straightforward to show that the remaining eigenvalue satisfies the constraints of the dual problem (i.e. 
all other three eigenvalues are positive), and therefore gives rise to an upper bound on Bob's maximal bias. 



V. BIASES IN THE FAIR SCENARIO 

To make the protocol fair, i.e. P^^' — P^f^ — Pj^\ we have the freedom to manipulate 0. In this way, for a single 

qubit we obtain p[]^ = p'^l^ = 0.9 {9 ~ 36.87°). In the two qubit case, the solution of the dual problem and Alice's 

maximal bias intersect for e ~ 26.92°, ^ ~ -0.2098, x - 0.6197, 1 - (^ + x) /4 ~ P^^ ~ 0.8975. It remains to prove 
that this intersection indeed corresponds to Bob's maximal bias, or, what is the same thing, to show that for this 
value of the angle the solution of the dual problem coincides with that of the primal problem. 

To do so we conjecture that the solution of the primal problem, eq. ([TS]) in the case = 2, is of the form 

2M^^^\v{e)){v{e)\ , (21) 

where 

It; {6)) = i= cos (/ {6)) |n> + \ in) + \ i;t) + ^ sin (/ {6)) lU) (22) 

and / is some real function of 6. It is easy to verify that eq. (PTjl satisfies the constraints eq. As a functional of 

/, the probability of biasing the outcome to (or 1) then reads 

^ A. 1^12 cos (2/ [9)) cos (61) + 2 sin (2/ [9)) sin^ [9) + cos (/ (6*)) (l2\/2 sin {9) + sin (261) ) 

+ sin (/ {9)) (12V2 sin {9) - sin {29)) - cos (261) + 37) . (23) 
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0.5 1.0 1.5 

Figure 3: Maximal biases as a function of 6 for N < 2 qubits. The dashed (solid) decaying curve depicts Alice's bias for N = 2 
(TV — 1) and the dashed (solid) rising curve depicts Bob's bias for N — 2 {N — 1). 

For e ~ 26.92° P^^f is maximized for / ~ 0.1177 equaling 0.8975 as anticipated. 

We see that while Alice's maximal bias decreases with the increase in the number of qubits, Bob's maximal bias 
increases as we go from one to two qubits (see Fig. 2). For a greater number of qubits, numerical based SDP evidence 
indicates the bias in the fair scenario continue to decrease with the increase in the number of qubits (Bob's bias 
increases), but at an increasingly slower rate. We were able to carry out numerics for up to six qubits, and obtained 

P^p^ ~ 0.8967, Pj,*^ = 0.8962, pj,^^ ~ 89.60, Pj,^^ ~ 0.8958 (in the later case 9 ~ 15.89°). 

VI. CONCLUSION 

It is possible to overcome the problem of losses in quantum CF. A loss-tolerant CF protocol has the property that 
its bias remains unchanged even if we allow for it to be restarted whenever losses occur. However, this robustness 
seems to come at a price. Berlin et al.'s loss-tolerant SCF protocol achieves a relatively high bias of 0.4. In this paper, 
by presenting a family of loss-tolerant SCF protocols, we were able to show that Berlin et a/.'s result can be improved 
upon. Utilizing a single qubit we reproduced their result, while utilizing a pair of qubits we obtained a bias of 0.3975. 
SDP based numerical evidence indicates that the bias continues to decrease as the number of qubits is increased, but 
at a rapidly decreasing rate. 

In future work it should be interesting to determine the theoretical limits on loss-tolerant CF protocols. Specifically, 
can Kitaev's bound be saturated by a loss-tolerant SCF protocol? If not, what is the bound on loss-tolerant SCF 
protocols? Furthermore, is it possible to introduce a loss-tolerant WCF protocol? Two main difficulties are apparent. 
First, at the end of a WCF protocol the losing party usually verifies the outcome by measuring a quantum system 
that has been kept in a quantum memory storage. Hence, in this scenario the losing party can always avoid losing 
by claiming to have lost the stored system. Second, the number of rounds of communication required to realize a CF 
protocol with a bias of e is of the order of f2(logloge~^). In particular, to achieve a loss-tolerant WCF protocol with 
an arbitrarily small bias will require the protocol to be impervious to losses occurring at any round, implying that a 
dishonest party must not be capable of (probabilistically) inferring whether it is going to win or lose at at any round 
before the last. 
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Appendix A 

Here we prove that Hp can be set equal to the identity (see remark below eq. (HJ), and we prove the constraints on 
primal problem, eq. p4p . 
Recall that 

E Kc=^p- (Ai) 

{b} {r|©.n=c} 

We would like to show that upon summation all Pauli basis vectors composed of or one or more of the or ay^ 
vanish. To see this, we note for every element in the sum Mg^ there is another element Mq^ , such that b'j = bj © Sij. 
Algebraically, this second element is identical to the first except that in its Pauli basis expansion the coefficient of 
every basis vector composed of either or <Ty^ has the opposite sign, so that upon summation they cancel each 
other. See eqs. dTU]) and pi|) . 

It remains to show that the sum of all Pauli basis vectors composed solely of one or more of the CTz and identity 
operators vanish. We note that for every element in the sum Mq^ there is another element MqJ^, such that = 
Tk © Sik © Sjk with i ^ j. This second element is identical to the first except that in its Pauli basis expansion the 
coefficients of basis vectors composed of either ai'''' or ai''^ (and identity operators), but not both, have opposite signs. 
See eqs. ([TU]) and ([TI]) . The vanishing of basis vectors composed of both o-i'' and crp'' (and identity operators), but 
not (^^x then follows from repeating this argument for all possible pairs of indices k and I ^ k. Hence, upon 
summation all Pauli basis vectors composed of one or more of the a^z \ except (S^iLi Cz*\ vanish, and it follows that 

{b} {r|®.n=c} 

However, from eq. (|If p we have that 

E E MocV=«l-7®iIi<TW. (A3) 

{b} {r|©. ri=cei} 

Since both eqs. (jA2[) and (IA3[) must be equal, the coefficient of ®f^ia^f' must vanish and Hp is seen to be proportional 
to the identity. This implies that Bob learns nothing from his first POVM with elements Hp and His, since both 
elements are proportional to the identity. So that without loss of generality we can take Hp equal to the identity. 

Finally, since the sum is composed of 2'^'^~^ 2^ x 2^-dimensional matrices, and since in its Pauli basis expansion 
each matrix admits the same coefficient for the identity, it follows that 2^^^Tr (7\fo^') = 1- Together, these last 
remarks imply the constraints in the SDP eq. p4l) . 
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